Feat/testing security improvements#141
Merged
Hexstar-labs merged 7 commits intoBrainTease:mainfrom Mar 28, 2026
Merged
Conversation
- Add .eslintrc.js for backend with @typescript-eslint rules - Add .eslintrc.js for frontend with React and TypeScript support - Add .prettierrc at repo root with consistent formatting rules - Add .prettierignore to exclude build artifacts and dependencies
- Add lint, lint:fix, format:check, and format scripts to both apps - Add ESLint and Prettier devDependencies with compatible versions - Update frontend to use ESLint instead of Next.js built-in linting - Ensure TypeScript ESLint compatibility across both apps
- Add deny.toml at repo root for Rust dependency policy enforcement - Configure advisories to deny warnings on vulnerabilities - Set up license allowlist (MIT, Apache-2.0, BSD variants, ISC, Unicode) - Configure bans for GPL and AGPL licenses - Enable duplicate dependency detection
…orts - Add lcov and html to coverageReporters for SonarCloud integration - Ensure coverage reports are generated in correct format for CI
- Create sonar-project.properties at repo root - Configure source paths for backend, frontend, and contracts - Set up coverage report paths for Jest (backend) and Vitest (frontend) - Enable quality gate with wait flag - Configure TypeScript language settings
…tation - Document OWASP ZAP scanning process and finding triage workflow - Provide common ZAP findings and remediation steps - Include local ZAP testing instructions - Document cargo audit and cargo deny usage - Add code quality and linting guidelines
…mprehensive CI/CD testing and security jobs - Add ESLint linting steps to backend and frontend build jobs - Add SonarCloud job for code quality analysis with coverage reporting - Add OWASP ZAP security scanning job with baseline scan and artifact upload - Add cargo audit and cargo deny checks to contracts job - Configure quality gates and security thresholds - Update job names for clarity
|
@caxtonacollins Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits. You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Testing & Security Improvements
Overview
Comprehensive implementation of testing and security enhancements across the Brain-Storm project, addressing issues #96, #97, #98, and #99.
Closes #96
Closes #97
Closes #98
Closes #99
Changes
Issue #97: ESLint and Prettier
.eslintrc.jsfor backend with @typescript-eslint rules.eslintrc.jsfor frontend with React and TypeScript support.prettierrcat repo root with consistent formatting rulesnpm run lint,npm run lint:fix,npm run format:check, andnpm run formatscripts to both appsIssue #98: SonarCloud Static Analysis
sonar-project.propertiesat repo rootIssue #99: Cargo Audit & Deny
deny.tomlat repo root for Rust dependency policy enforcementcargo audit --deny warningsstep to CIcargo deny checkstep to CIIssue #96: OWASP ZAP Security Scanning
-aflag)zap-report.htmlas CI artifactdocs/security.mdwith comprehensive security guidelines and triage workflowCI/CD Updates
Documentation
docs/security.mdwith:Testing
All configurations have been validated:
Breaking Changes
None. All changes are additive and backward compatible.
Migration Guide
No migration needed. Developers should:
npm installto get new devDependenciesnpm run lint:fixandnpm run formatto fix existing codedocs/security.mdfor security best practices